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(U) Have you ever watched television news and heard a report that started out something like 
this: "Today, reliable sources revealed that U.S. intelligence has intercepted communications 
indicating that..."? You may have thought to yourself, "How in the world is this information 
getting out?" If so, you are not alone! 

(U//FOUO) SID has a special office that tracks disclosures of this kind: the SID/Intelliaence 
Security Issues office (502131 . They are responsible for monitoring so-called Cryptologic 
Insecurities (Cl), which occur when "cryptologic material or information is put in jeopardy or 
when sensitive information is disclosed through espionage or by unauthorized disclosure." Often, 
this means media leaks. 

(U) Media Leaks 

(TS//SI) Let's take a look at some examples of damaging media leaks and the unfortunate 
consequences: 

— (TS//SI) Media leaks from 2000-2002 disclosed that we were collecting SIGINT against 
Usama bin Laden and al-Qaeda operatives: 

• (TS//SI) A CBS News report from September 2002 stated "The National Security Agency, 
which monitors communications worldwide, intercepted a phone call from one of UBL's 
operatives in Afghanistan to a phone number in the former Soviet Republic of Georgia," 
revealing NSA sources and methods as well as the extent of our capabilities against our 
adversaries. 

Damage assessment : al-Qaeda immediately employed improved security measures and 
deceptive tactics to limit our SIGINT collection. Such disclosures prove time and time and 
again that our adversaries initiate active Denial and Deception tactics to thwart our 
capabilities. 

Follow-on action : NSA's Office of General Counsel issued a formal report to the U.S. 
Department of Justice of the unauthorized disclosure of COMINT information and 
requested a follow-on FBI investigation. The unauthorized disclosure of COMINT 
information represents a criminal violation and is subject to FBI investigation as such. 

• (TS//SI) A November 2002 New York Times Daily News article revealed specific 
information regarding NSA geolocation capabilities during a very high-profile operation to 
eliminate a known al-Qaeda terrorist operative. 

Damage assessment : Such disclosures of NSA's role in these lethal operations hinder 
NSA's capability to support the ongoing fight against global terrorism. The potential for 
loss of lucrative source information increases astronomically. 

• (TS//SI) The Washington Times reported in October 2000 that SIGINT was targeting and 
tracking terrorists suspected in the USS Cole bombing. 

Damage assessment : Al-Qaeda initially heightened their security awareness and 
practices, then in December 2001, the source went off the air, creating a significant 
collection gap. 

(U) ...but leaks are not limited to the topic of al-Qaeda: 

— (TS//SI) A December 2002 WorldNetDaily.com article, while it did not provide specific 
classified information based on SIGINT product, did provide an accurate and unauthorized 
disclosure of NSA's capabilities. Specifically, the article indicated that NSA had lost its ability to 
collect information on activities in Iran, thus disclosing a collection gap on a high-priority target 


for the United States. The article was released shortly after we lost collection of Iranian 
Intelligence Service communications. 

Damage assessment : Vulnerabilities in our abilities against a high-interest target were 
revealed. 

Follow-on action : NSA's Office of General Counsel issued a formal report to the U.S. 

Department of Justice of the unauthorized disclosure of COMINT information and requested a 
follow-on FBI investigation. The unauthorized disclosure of COMINT information represents a 
criminal violation and is subject to FBI investigation as such. 

(U//FOUO) Coming in part two of this article: What happens when CIs are discovered and what 
is your role? 


"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet 
without the consent of S0121 (DL sid comms) ." 
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